5 ms·

This is really awesome work. I spent a lot of time in the early 2000s coming up with nasty obfuscation techniques to protect certain IP that inherently needed

This is really awesome work. I spent a lot of time in the early 2000s coming up with nasty obfuscation techniques to protect certain IP that inherently needed to be run client-side in casino games. Up to and including inserting bytecode that was custom crafted to intentionally crash off-the-shelf decompilers that had to run the code to disassemble it (and forcing them to phone home in the process where possible!) My view on obfuscation is that since it's never a valid security practice, it's only admissible for hiding machinery from the general public. For instance, if you have IP you want to protect from average script kiddies. Any serious IP can be replicated by someone with deep pockets anyway. Most other uses of code obfuscation are nefarious, and obfuscated code should always be assumed to be malicious until proven otherwise. I'm not a reputable large company, but no reputable large company should be going to these lengths to hide their process from the user, because doing so serves no valid security purpose.

maria2 4y ago
White box crypto is kind of like obfuscation, but tries to make it impossible to extract the information.
- deleted 4y ago
  [deleted]
- awestroke 4y ago
  No, encryption is very different from obfuscation, even if the former is often used in the latter
  - xurukefi 4y ago
    You missed the point. maria2 is talking about whitebox crypto. The "whitebox" part means that the decryption process happens on your machine incuding the secrets, which are present in some obfuscated scrambled form in memory. Getting the secret key is a matter of debugging and understanding the obfuscation scheme. A prime example of this is DRM like Widevine (L3) in the chrome browser.
    - bitexploder 4y ago
      I am really failing to understand the distinction here. Encryption with say, AES has very different properties and use cases compared to an obfuscation scheme. You can use encryption as a part of an obfuscation scheme, but obfuscation is a shell game, all the way down. Crypto is not, mathematically. They are categorically different things, right?
      - grog454 4y ago
        The math is irrelevant when the key is known to all parties.
        bitexploder 4y ago
        Sure. That is DRM and obfuscation in a nutshell. How annoying can I make this for you to reverse engineer?
      - toast0 4y ago
        Obfuscation with encryption can be done with good ciphers, like AES, but the key is still shipped with the code, so it's still just cat and mouse. It's a little different if the key is hardware specific, so each binary only runs on one system and it's hard to extract the keys, but that's not a typical setup. Usually it's this code needs to run on the general public's computers or phones, and that's too general a target to rely on hardware crypto.
      - matmann2001 4y ago
        The key specifier word was "whitebox". They aren't speaking generally about cryptography.
- krackers 4y ago
  There's also indistinguishability obfuscation which I recall recently had a breakthrough in terms of practical construction
jstanley 4y ago
Wait, why is a casino protecting it's so-called "intellectual property" legitimate and above-board, but TikTok doing the same is not?
- margalabargala 4y ago
  I don't think OP was defending their own earlier work or otherwise exempting it from their assertion that all obfuscated code should be considered malicious.
  - jstanley 4y ago
    Having reread it, I think you might be right. > it's only admissible for hiding machinery from the general public. I had originally read this to imply that somehow it's OK for a casino to hide its machinery from the general public, but it's not OK for TikTok to hide its machinery from the general public, but maybe "machinery" here is intended much more narrowly, and OP thinks it applies neither to casinos nor TikTok.
    - compsciphd 4y ago
      I read it as the only "legitimate" point is to hide it from the general public. As people with more resources will be able to figure it out. If you view that as legitimate is up to each person to decide. Does the value of trying to hide it from the general public have real value or not. In general the answer might be no.
      - noduerme 4y ago
        "General public" was really the wrong term. I meant people with the ability to decompile and use assets or portions of the code for their own games. This was in the early years of Bitcoin when fly-by-night casinos were sprouting up everywhere. Most of them were really badly coded - e.g. the slot machines looked like they'd been drawn by a six year old. Others looked like legitimate casinos, but were actually running cracked versions of white label software. Ours was the only in the space that had a large, professional, fully original codebase... that was what I meant by "machinery", not the machinery governing user interactions with the server (see my response above).
bobleeswagger 4y ago
> since it's never a valid security practice Why not? It's just another tool in the security game. I want to be with you on thinking that all obfuscation is malicious, I know that individuals have every right to obfuscation and privacy as a matter of the 1st and 4th amendments in the US, but I'm not sure I can always say that obfuscation by a corporation is evil, without a more compelling argument. I'm as anti-establishment as they come, too.
- ViViDboarder 4y ago
  I think l the reason is that it means that they don’t trust or don’t want their users to know what they are doing on your machine. To me, that is already a malicious premise. Even if they aren’t trying to exfiltrate my data or anything.
  - bobleeswagger 4y ago
    I guess the acceptable form of obfuscation would mean only IP is protected by it, not everything. I wonder what it would take to enforce this as the norm, certainly doesn't sound easy.
- mtnygard 4y ago
  I read the GP a bit differently... I didn't read it as saying obfuscation is evil, just that it is ineffective. More like "obfuscation can't prevent reversing, therefore it's not a valid security practice since all it does is slow down the casual observer but does not stop the determined adversary." The statement that most use of obfuscation is nefarious is a corollary... since obfuscation doesn't protect IP it is mostly used to hide malicious activity.
  - noduerme 4y ago
    This, exactly. Thank you for putting it so succinctly.
dbrueck 4y ago
Agreed - obfuscation is useful for keeping honest people honest. If someone is sufficiently motivated, they will circumvent it, but for the vast majority of people it's just not worth the effort so they'll move to something else. For example, in our application we have some optionally downloadable content that includes some code for an interpreted language. That code lives on disk in an obfuscated form because we are not yet ready to make the API public (it's on our "someday" roadmap), we don't want to clean up the code for public viewing, and above all because there are different licensing requirements around each content pack. We looked at various "real" security options and they all have holes, and they all add a ton of complexity. We then also looked at the likely intersection between "people who would pay for this" and "people who could crack this", and there's not much there. In the end, obfuscation is cheap (especially in terms of implementation and maintenance) and steers our real customers away violating the license, and we don't waste resources on dishonest people. If I'm being charitable, the obfuscation in the article has an out of whack cost/benefit ratio. If I'm being cynical, the obfuscation they are doing strays well into the realm of nefarious. :)
- thrashh 4y ago
  People knock on obfuscation but everything in life is based on trust. Locks being breakable, the fruit stand in front of a shop being unprotected, fences being scalable. Everything is a cost/benefit
  - rowanG077 4y ago
    It's the curse of ideological purity you see in a lot of the tevh sevtor. Most of these types are of the sort that either something is unbreakable or it's useless.
- noduerme 4y ago
  Just as a fun aside, I was perusing some of my most ancient HN threads and came across this obfuscated monster which I totally forgot about. Pastebin links inside are still active ;) https://news.ycombinator.com/item?id=3432800 https://news.ycombinator.com/item?id=3432800

maria2 4y ago

White box crypto is kind of like obfuscation, but tries to make it impossible to extract the information.

deleted 4y ago
[deleted]
awestroke 4y ago
No, encryption is very different from obfuscation, even if the former is often used in the latter
- xurukefi 4y ago
  You missed the point. maria2 is talking about whitebox crypto. The "whitebox" part means that the decryption process happens on your machine incuding the secrets, which are present in some obfuscated scrambled form in memory. Getting the secret key is a matter of debugging and understanding the obfuscation scheme. A prime example of this is DRM like Widevine (L3) in the chrome browser.
  - bitexploder 4y ago
    I am really failing to understand the distinction here. Encryption with say, AES has very different properties and use cases compared to an obfuscation scheme. You can use encryption as a part of an obfuscation scheme, but obfuscation is a shell game, all the way down. Crypto is not, mathematically. They are categorically different things, right?
    - grog454 4y ago
      The math is irrelevant when the key is known to all parties.
      - bitexploder 4y ago
        Sure. That is DRM and obfuscation in a nutshell. How annoying can I make this for you to reverse engineer?
    - toast0 4y ago
      Obfuscation with encryption can be done with good ciphers, like AES, but the key is still shipped with the code, so it's still just cat and mouse. It's a little different if the key is hardware specific, so each binary only runs on one system and it's hard to extract the keys, but that's not a typical setup. Usually it's this code needs to run on the general public's computers or phones, and that's too general a target to rely on hardware crypto.
    - matmann2001 4y ago
      The key specifier word was "whitebox". They aren't speaking generally about cryptography.
krackers 4y ago
There's also indistinguishability obfuscation which I recall recently had a breakthrough in terms of practical construction

jstanley 4y ago

Wait, why is a casino protecting it's so-called "intellectual property" legitimate and above-board, but TikTok doing the same is not?

margalabargala 4y ago
I don't think OP was defending their own earlier work or otherwise exempting it from their assertion that all obfuscated code should be considered malicious.
- jstanley 4y ago
  Having reread it, I think you might be right. > it's only admissible for hiding machinery from the general public. I had originally read this to imply that somehow it's OK for a casino to hide its machinery from the general public, but it's not OK for TikTok to hide its machinery from the general public, but maybe "machinery" here is intended much more narrowly, and OP thinks it applies neither to casinos nor TikTok.
  - compsciphd 4y ago
    I read it as the only "legitimate" point is to hide it from the general public. As people with more resources will be able to figure it out. If you view that as legitimate is up to each person to decide. Does the value of trying to hide it from the general public have real value or not. In general the answer might be no.
    - noduerme 4y ago
      "General public" was really the wrong term. I meant people with the ability to decompile and use assets or portions of the code for their own games. This was in the early years of Bitcoin when fly-by-night casinos were sprouting up everywhere. Most of them were really badly coded - e.g. the slot machines looked like they'd been drawn by a six year old. Others looked like legitimate casinos, but were actually running cracked versions of white label software. Ours was the only in the space that had a large, professional, fully original codebase... that was what I meant by "machinery", not the machinery governing user interactions with the server (see my response above).

bobleeswagger 4y ago

> since it's never a valid security practice Why not? It's just another tool in the security game. I want to be with you on thinking that all obfuscation is malicious, I know that individuals have every right to obfuscation and privacy as a matter of the 1st and 4th amendments in the US, but I'm not sure I can always say that obfuscation by a corporation is evil, without a more compelling argument. I'm as anti-establishment as they come, too.

ViViDboarder 4y ago
I think l the reason is that it means that they don’t trust or don’t want their users to know what they are doing on your machine. To me, that is already a malicious premise. Even if they aren’t trying to exfiltrate my data or anything.
- bobleeswagger 4y ago
  I guess the acceptable form of obfuscation would mean only IP is protected by it, not everything. I wonder what it would take to enforce this as the norm, certainly doesn't sound easy.
mtnygard 4y ago
I read the GP a bit differently... I didn't read it as saying obfuscation is evil, just that it is ineffective. More like "obfuscation can't prevent reversing, therefore it's not a valid security practice since all it does is slow down the casual observer but does not stop the determined adversary." The statement that most use of obfuscation is nefarious is a corollary... since obfuscation doesn't protect IP it is mostly used to hide malicious activity.
- noduerme 4y ago
  This, exactly. Thank you for putting it so succinctly.

dbrueck 4y ago

Agreed - obfuscation is useful for keeping honest people honest. If someone is sufficiently motivated, they will circumvent it, but for the vast majority of people it's just not worth the effort so they'll move to something else. For example, in our application we have some optionally downloadable content that includes some code for an interpreted language. That code lives on disk in an obfuscated form because we are not yet ready to make the API public (it's on our "someday" roadmap), we don't want to clean up the code for public viewing, and above all because there are different licensing requirements around each content pack. We looked at various "real" security options and they all have holes, and they all add a ton of complexity. We then also looked at the likely intersection between "people who would pay for this" and "people who could crack this", and there's not much there. In the end, obfuscation is cheap (especially in terms of implementation and maintenance) and steers our real customers away violating the license, and we don't waste resources on dishonest people. If I'm being charitable, the obfuscation in the article has an out of whack cost/benefit ratio. If I'm being cynical, the obfuscation they are doing strays well into the realm of nefarious. :)

thrashh 4y ago
People knock on obfuscation but everything in life is based on trust. Locks being breakable, the fruit stand in front of a shop being unprotected, fences being scalable. Everything is a cost/benefit
- rowanG077 4y ago
  It's the curse of ideological purity you see in a lot of the tevh sevtor. Most of these types are of the sort that either something is unbreakable or it's useless.
noduerme 4y ago
Just as a fun aside, I was perusing some of my most ancient HN threads and came across this obfuscated monster which I totally forgot about. Pastebin links inside are still active ;) https://news.ycombinator.com/item?id=3432800 https://news.ycombinator.com/item?id=3432800